Threat Actors Exploit a Critical Ivanti RCE Bug, Again

A suspected Chinese-linked APT (UNC5337) is actively exploiting a critical unauthenticated RCE (CVE-2025-0282, CVSS 9.0) in Ivanti Connect Secure and related gateways to deploy bespoke persistent malware (Spawn family) plus additional scripts (DryHook, PhaseJam); a second authenticated buffer overflow (CVE-2025-0283) was identified but not observed exploited. Ivanti and CISA have issued mitigations and patches; defenders are urged to run Ivanti’s Integrity Checker Tool and patch immediately to detect and remediate compromises.